Why not just start with rising column? If you run it as a batch, it will run again on your configured interval and re-index all the records again if you do not disable the input before the 2nd run.
Max rows to retrieve limits the total amount of records pulled for a batch input, the default is 0. Fetch size is how many records dbconnect will pull per pass to keep from requesting 26 million rows at once.
... View more
Hi @TBeekley,
You can change checkpoint value in $SPLUNK_HOME/etc/apps/splunk_app_db_connect/local/inputs.conf , in this file find your DB Input monitor stanza and change tail_rising_column_checkpoint_value parameter value, it stores checkpoint value and then you need to restart splunk so that splunk will consider new checkpoint value which you have given.
I hope this helps.
Thanks,
Harshil
... View more